CVE-2026-50008
1 advisory.
npm/parse-server CVE-2026-50008: medium
parse-server: Server option routeAllowList is bypassable through batch sub-requests
Action: Upgrade parse-server to 9.9.1-alpha.3 or later.
npm i parse-server@9.9.1-alpha.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 9.8.0 | 9.9.1-alpha.3 | - |
Fixed versions
| 9.9.1-alpha.3 |
Sources
- osv: GHSA-p84r-h6rx-f2xr
- https://github.com/parse-community/parse-server/security/advisories/GHSA-p84r-h6rx-f2xr
- https://nvd.nist.gov/vuln/detail/CVE-2026-50008
- https://github.com/parse-community/parse-server/pull/10482
- https://github.com/parse-community/parse-server
CVE-2026-50008 · published · modified · JSON